CS5430: System Security (Fall 2023) - Overview and Organization

Students who complete this course are able to:

• Read and discuss existing cybersecurity literature.
• Formulate security policies required for systems and applications.
• Understand how to implement authentication for machines and people.
• Implement authorization using access control, credentials, and information flow.
• Implement isolation for processes, virtual machines, and compartments.
• Design reference monitors and program rewriters for enforcing specific policies.
• Identify system assumptions that can be exploited by attackers.

Course URL:   http://www.cs.cornell.edu/Courses/CS5430/2023FA/

Lecture: Attendance is required at all of our class meetings. If you must miss a session, arrange with another student to find out the material you missed.

10:10 -- 11:25 Monday, Wednesday, Friday in 205 Thurston Hall

Instructor:

Professor Fred B. Schneider   (255-9221)   422 Gates Hall

Office hours:

• Directly after lecture.
  

• Monday afternoons: 130pm - 3pm.
  

• Schneider is often in the office weekdays after 3pm --- feel free to drop-in without an appointment. If we can't chat then, we can work out a time to meet.
  

email: fbs@cs.cornell.edu  

Course Staff:

Goktug Saatcioglu gs724@cornell.edu
Barry Wang zw545@cornell.edu

TA Office Hours:

Day	Time	Location	TA
Tues	4:00pm - 6:00pm	Rhodes 412	Wang
Thurs	1:30pm - 3:30pm	Rhodes 574	Wang

Prerequisites. The course is open to any undergraduate or graduate student who has mastered the material in CS4410 (Operating Systems).

Readings:

Readings to complement the lectures are noted in the course outline. Students are expected to stay current by reading the relevant documents after the material has been covered in lecture.

Assignments and Grading: Final course grades will be computed as follows:

• 25% Midterm Examination. Closed book examination, scheduled for the evening of Thursday October 26, 2023 in Kimball B11.

• 25% Final Examination. Closed book examination. The exam is cumulative but will emphasize material covered after the midterm examination.
• 40% Programming Project. Students work in groups of 2 or 3 to build a secure key-value storage system using the Java programming language. The project involves multiple phases.
• 10% Written Homework. 3-4 written assignments. Each student must work alone on each of these written homework assignments. The written homework assignments are intended to motivate a careful study of the reading and to provide opportunities for exercising what you are learning. A solution will receive full credit if what you submit represents a good faith effort (right or wrong).

All assignments are due on the date stipulated, so that correct answers can be distributed and/or freely discussed in lecture after the due date.

Any student who has taken the midterm examination, submitted all phases of the programming project, and submitted all homework may elect to skip the final examination. If you do not submit a final examination for grading then your prelim grade will count for 50% of your final grade (rather than 25%).

Expect to receive a final course grade of B- or better if you submit all of the written homework assignments, all phases of the project, take the midterm or final, and only miss lectures when there is a university-documented medical excuse.

Academic Integrity. Violations of the following academic integrity policy for CS5430 will be prosecuted. You may not discuss or collaborate with other students in the class on the assigned homeworks. You may discuss the programming project only with other members of your project group. The source and the sink in an illicit collaboration both will receive a penalty. In addition, you may not use ChatGPT or any other form of AI for the assigned homeworks or for the programming project.

Course materials appearing on the course web site or provided to you in CMS are the intellectual property of Professor Schneider. Students are not permitted to share, buy, or sell those materials. Such unauthorized behavior constitutes academic misconduct. In addition, you are prohibited from posting, submitting, or acquiring course materials or content through online "study" platforms. If you acquire or otherwise access course materials through such a platform, you are violating the Code of Academic Integrity. (Cornell is able to trace posts from internet sites, including identifying the individuals who provide content and those who access and/or use the content).

Finally, students are expected to be familiar with the University's and the CS Department's various policies on appropriate use of computers.

Inclusion. Students in this course come from a variety of backgrounds, abilities, and identities. We celebrate and benefit from that diversity. To promote learning for all, each student and staff member is expected to contribute at all times to an inclusive and respectful environment in and out of class. If you feel that this is not happening, please contact Professor Schneider.

COVID 19 and Other Illness. Zoom recordings of lecturers are not available for absences, including absences due to illness. For any illness, you are expected to keep up with course material by working with a peer in the course and reading the on-line notes.

If you have symptoms of COVID 19, then proceed as follows.

1. Do not come to class.
2. Send email to Professor Schneider before class starts to state that you are (i) not coming to class and (ii) are instead seeking out an antigen test. According to university policy and free access to tests, you will be able to take a test immediately upon noticing symptoms and will have a result within minutes.
   • If the test is negative, then attend in the next class, having caught up on material from a classmate or the shared notes page.
   • If your antigen test is positive, then immediately upload the result to Daily Check. This will trigger instructions and a letter of temporary accommodation. You must forward this email to Professor Schneider to receive accommodation.
3. Wear a mask in class through the 10th day after symptoms begin.